» tidynetwork.exe
Overview
Analysis
File Details
Programs (1)
Network (2)

tidynetwork.exe

Tidy Network

This is part of the InfoAtoms browser extension which will display variopus forms of advertising in the web browser by injecting new ads such as banner, text-links and search results. The application tidynetwork.exe by Tidy Network has been detected as adware by 3 anti-malware scanners. This file is typically installed with the program HelperApps by TidyNetwork.com which is a potentially unwanted software program. While running, it connects to the Internet address files.tidynetwork.com on port 80 using the HTTP protocol.

File name:

tidynetwork.exe

Publisher:

PETN (signed by Tidy Network)

Version:

5.1715

MD5:

ffee35eda3e18fd46fe8644409ff8ad0

SHA-1:

daad9a968bcddfb697d422c29c6e7a24ccf86feb

SHA-256:

85aa04302680012eab7f11e2701df10c7dd174e758dbe189eec59dd5377f8cf6

Scanner detections:

3 / 68

Status:

Adware

Analysis date:

11/23/2024 2:26:33 PM UTC (today)

Scan engine

Detection

Engine version

Reason Heuristics

PUP.TidyNetwork.L

14.8.8.2

Sophos

Tidy Network

4.96

VIPRE Antivirus

Tidy2Network

24798

File size:

1.2 MB (1,250,600 bytes)

Product version:

5.1715

Original file name:

petn.exe

File type:

Executable application (Win32 EXE)

Common path:

C:\users\{user}\appdata\local\tidynetwork\tidynetwork.exe

Digital Signature

Signed by:

Tidy Network

Authority:

VeriSign, Inc.

Valid from:

3/20/2013 3:00:00 AM

Valid to:

3/20/2016 2:59:59 AM

Subject:

CN=Tidy Network, OU=Digital ID Class 3 - Microsoft Software Validation v2, O=Tidy Network, L=SAN FRANCISCO, S=California, C=US

Issuer:

CN=VeriSign Class 3 Code Signing 2010 CA, OU=Terms of use at https://www.verisign.com/rpa (c)10, OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US

Serial number:

5B80FB156CAB4137B00AFF13BA26609D

File PE Metadata

Compilation timestamp:

12/5/2013 8:54:33 PM

OS version:

5.1

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

10.0

CTPH (ssdeep):

24576:I66yXovK60IbK6F0PS5CAI0O+6BJov8xS3b6vFFYBAhQzDyJ6USEj6PNUIG7n:p6JTbBF0PSCA99OSv8xS3u8yQznUBMqz

Entry address:

0x859BD

Entry point:

E8, 23, 9E, 00, 00, E9, 89, FE, FF, FF, 6A, 0C, 68, A8, 7E, 4A, 00, E8, 1D, 08, 00, 00, 6A, 0E, E8, 20, A0, 00, 00, 59, 83, 65, FC, 00, 8B, 75, 08, 8B, 4E, 04, 85, C9, 74, 2F, A1, B8, CC, 4A, 00, BA, B4, CC, 4A, 00, 89, 45, E4, 85, C0, 74, 11, 39, 08, 75, 2C, 8B, 48, 04, 89, 4A, 04, 50, E8, 27, DF, FF, FF, 59, FF, 76, 04, E8, 1E, DF, FF, FF, 59, 83, 66, 04, 00, C7, 45, FC, FE, FF, FF, FF, E8, 0A, 00, 00, 00, E8, 0C, 08, 00, 00, C3, 8B, D0, EB, C5, 6A, 0E, E8, EC, 9E, 00, 00, 59, C3, CC, CC, CC, CC, CC, CC... 
[+]

Entropy:

7.4736

Code size:

601.5 KB (615,936 bytes)

The file tidynetwork.exe has been discovered within the following program.

HelperApps by TidyNetwork.com

Publisher's description - “TidyNetwork is a free browser add-on that brings you exclusive deals while you browse the Internet. For example, if you are looking for a new pair of shoes, TidyNetwork can help you find the lowest price from trusted stores, or even a coupon from the store you’re visiting.”

www.tidynetwork.com

81% remove it

The executing file has been seen to make the following network communications in live environments.

TCP (HTTP):

Connects to services.tidynetwork.com (96.126.104.111:80)

http://services.tidynetwork.com/general/ping.php?tidyaction=tidyinstallbegin&tidyversion=5&tidyos=NT-Platform&tidyguid={...}&tidysourcetype=tidy&tidycompany=TidyNetwork.com&tidysourceid=

TCP (HTTP):

Connects to files.tidynetwork.com (69.16.175.10:80)

Remove tidynetwork.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.